Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-06-2024 15:43

General

  • Target

    9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe

  • Size

    612KB

  • MD5

    9b3250409072ce5b4e4bc467f29102d2

  • SHA1

    86a2fad69241a68a129c25531d5aea8ba2304bc3

  • SHA256

    24f089cd7b8348eea7f18b3d69fe7bd4d000f1a4c2ba7889a5e133e9862cc1e2

  • SHA512

    e7101b2f5d63410920d3b58e2c12ca00edba1351aa7d31cfa139af49f21f25fe328c0e446ee2885b046ca52083dfb012a6ea7555d86c098287dc1ff91d89b31f

  • SSDEEP

    12288:RfEKhhYNpXXreuGFzpY2zkF9a37WSTUE8vcbI91BntKpzRrYBMKj:RcKMNpHqDJhLu35DzKJd

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4536
    • C:\Users\Admin\AppData\Local\Temp\9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4500
      • C:\Users\Admin\AppData\Local\Temp\9b3250409072ce5b4e4bc467f29102d2_jaffacakes118\9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\9b3250409072ce5b4e4bc467f29102d2_jaffacakes118\9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4468
        • C:\Users\Admin\AppData\Local\Temp\9b3250409072ce5b4e4bc467f29102d2_jaffacakes118\9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\9b3250409072ce5b4e4bc467f29102d2_jaffacakes118\9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:3204
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:228
        • C:\Windows\SysWOW64\PING.EXE
          ping 1.1.1.1 -n 1 -w 1000
          4⤵
          • Runs ping.exe
          PID:1732
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:3288

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe.log

      Filesize

      706B

      MD5

      2ef5ef69dadb8865b3d5b58c956077b8

      SHA1

      af2d869bac00685c745652bbd8b3fe82829a8998

      SHA256

      363502eb2a4e53ba02d2d85412b901fcf8e06de221736bdffa949799ef3d21e3

      SHA512

      66d4db5dd17d88e1d54ea0df3a7211a503dc4355de701259cefccc9f2e4e3ced9534b700099ffbb089a5a3acb082011c80b61801aa14aff76b379ce8f90d4fd3

    • C:\Users\Admin\AppData\Local\Temp\9b3250409072ce5b4e4bc467f29102d2_jaffacakes118\9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe

      Filesize

      612KB

      MD5

      9b3250409072ce5b4e4bc467f29102d2

      SHA1

      86a2fad69241a68a129c25531d5aea8ba2304bc3

      SHA256

      24f089cd7b8348eea7f18b3d69fe7bd4d000f1a4c2ba7889a5e133e9862cc1e2

      SHA512

      e7101b2f5d63410920d3b58e2c12ca00edba1351aa7d31cfa139af49f21f25fe328c0e446ee2885b046ca52083dfb012a6ea7555d86c098287dc1ff91d89b31f

    • C:\Users\Admin\AppData\Roaming\Imminent\Path.dat

      Filesize

      62B

      MD5

      ff21416d8dfef8ed5bdb0167cba7ceb9

      SHA1

      900b5fba86733095ff7beca58dc099236be7a17a

      SHA256

      6e513b4c0e77cceeefea09f3e745868277a81fcba3f954e02f4004f0ba589aad

      SHA512

      8946cc6d5581dfa692ee09a9c7d3e92d856db9daadc440ac03c14054d121a8be60ce9c29051baaadb4cc0d3630e2143ebb0f3ecf317d20a22624f07ce958683f

    • memory/3204-38-0x0000000005130000-0x000000000513A000-memory.dmp

      Filesize

      40KB

    • memory/3204-37-0x0000000004F40000-0x0000000004F56000-memory.dmp

      Filesize

      88KB

    • memory/4468-34-0x00000000750E0000-0x0000000075890000-memory.dmp

      Filesize

      7.7MB

    • memory/4468-30-0x00000000750E0000-0x0000000075890000-memory.dmp

      Filesize

      7.7MB

    • memory/4468-32-0x00000000750E0000-0x0000000075890000-memory.dmp

      Filesize

      7.7MB

    • memory/4500-31-0x00000000750E0000-0x0000000075890000-memory.dmp

      Filesize

      7.7MB

    • memory/4500-8-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/4500-11-0x00000000750E0000-0x0000000075890000-memory.dmp

      Filesize

      7.7MB

    • memory/4500-12-0x00000000050A0000-0x00000000050B0000-memory.dmp

      Filesize

      64KB

    • memory/4500-18-0x0000000007A10000-0x0000000007A28000-memory.dmp

      Filesize

      96KB

    • memory/4500-14-0x00000000750E0000-0x0000000075890000-memory.dmp

      Filesize

      7.7MB

    • memory/4500-15-0x00000000052E0000-0x000000000538E000-memory.dmp

      Filesize

      696KB

    • memory/4500-16-0x0000000005180000-0x00000000051A8000-memory.dmp

      Filesize

      160KB

    • memory/4500-17-0x0000000006D50000-0x0000000006DB6000-memory.dmp

      Filesize

      408KB

    • memory/4536-6-0x00000000750E0000-0x0000000075890000-memory.dmp

      Filesize

      7.7MB

    • memory/4536-13-0x00000000750E0000-0x0000000075890000-memory.dmp

      Filesize

      7.7MB

    • memory/4536-7-0x0000000008060000-0x00000000080FC000-memory.dmp

      Filesize

      624KB

    • memory/4536-0-0x00000000750EE000-0x00000000750EF000-memory.dmp

      Filesize

      4KB

    • memory/4536-5-0x0000000004C40000-0x0000000004C5C000-memory.dmp

      Filesize

      112KB

    • memory/4536-4-0x0000000004F70000-0x0000000004FDA000-memory.dmp

      Filesize

      424KB

    • memory/4536-3-0x0000000004C90000-0x0000000004D22000-memory.dmp

      Filesize

      584KB

    • memory/4536-2-0x0000000005150000-0x00000000056F4000-memory.dmp

      Filesize

      5.6MB

    • memory/4536-1-0x0000000000360000-0x0000000000402000-memory.dmp

      Filesize

      648KB